Hacker News Reader

Comment by semenko | Hacker News Reader

EDIT: Looks like this is now working! Looks like there is a tiny UI bug -- make sure your account is correctly selected on the Security Token page if you have multiple accounts signed in. #userError

Ouch, looks like a serious downside is that a given key can only be used with one Google account.

Trying to add a U2F-compatible token to more than one Google account results in errors: "This Security Key is already registered. Use a key that is not registered yet and try again."

View on HN

I just looked at the specification for this, it looks like a Google-specific limitation. There's no reason why a single site couldn't support the same U2F for multiple accounts.

In fact in Google's presentation they advertise a husband and wife using the same exact token for both of their accounts [0].

[0] https://sites.google.com/site/oauthgoog/gnubby

Ah, it looks like their FAQ also says this is supported:

   Can I use the same Security Key with multiple Google Accounts?
   Yes. You can register the same Security Key with multiple Google Accounts.

https://support.google.com/accounts/answer/6103543?hl=en

I have the same security keys registered with three completely different google accounts (two completely unrelated domain accounts and one gmail account), so i'm not sure what's going on for you.

Same thing just happened to me -- however, I was able to register a second account by signing out of all my Google accounts and then signing back in on just the account to which I wanted to add the key.

Huh, that's odd. I just registered a second google account with the same security key and everything seems to have gone fine. I'd recommend filing a bug and/or posting more details here.

Reply on news.ycombinator.com